critical9.8
CVE-2016-3067
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
Impact
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cygwin | Cygwin | through 2.4.1-1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://cygwin.com/ml/cygwin-announce/2016-02/msg00023.html
- https://cygwin.com/ml/cygwin-announce/2016-04/msg00020.html
- https://cygwin.com/ml/cygwin-announce/2016-04/msg00054.html
- https://cygwin.com/ml/cygwin/2016-02/msg00129.html
- https://sourceware.org/git/?p=newlib-cygwin.git%3Ba=commit%3Bh=205862ed08649df8f50b926a2c58c963f571b044
- https://cygwin.com/ml/cygwin-announce/2016-02/msg00023.html
- https://cygwin.com/ml/cygwin-announce/2016-04/msg00020.html
- https://cygwin.com/ml/cygwin-announce/2016-04/msg00054.html
- https://cygwin.com/ml/cygwin/2016-02/msg00129.html
- https://sourceware.org/git/?p=newlib-cygwin.git%3Ba=commit%3Bh=205862ed08649df8f50b926a2c58c963f571b044